@blamejs/core 0.14.1 → 0.14.2

package/lib/backup/index.js

@@ -1118,7 +1118,7 @@ function bundleAdapterStorage(opts) {
   var passphraseMinEntropyBits;
   if (opts.passphraseMinEntropyBits === undefined ||
       opts.passphraseMinEntropyBits === null) {
-    passphraseMinEntropyBits = 80;                                                    // allow:raw-byte-literal — entropy-bits default floor, not byte count
+    passphraseMinEntropyBits = 80;                                                    // entropy-bits default floor, not byte count
   } else if (Number.isFinite(opts.passphraseMinEntropyBits) &&
              opts.passphraseMinEntropyBits >= 0) {
     passphraseMinEntropyBits = Math.floor(opts.passphraseMinEntropyBits);
@@ -1164,8 +1164,8 @@ function bundleAdapterStorage(opts) {
     // v0.12.11 — passphrase strategy under HIPAA / PCI-DSS raises
     // the entropy floor to 128 bits (matches the framework's
     // existing crypto-grade-password discipline for sealed-storage).
-    if (cryptoStrategy === "passphrase" && passphraseMinEntropyBits < 128) {          // allow:raw-byte-literal — entropy-bits floor, not byte count
-      passphraseMinEntropyBits = 128;                                                  // allow:raw-byte-literal — entropy-bits floor, not byte count
+    if (cryptoStrategy === "passphrase" && passphraseMinEntropyBits < 128) {          // entropy-bits floor, not byte count
+      passphraseMinEntropyBits = 128;                                                  // entropy-bits floor, not byte count
     }
   }
   // Codex P2 on v0.12.8 PR #159 — tar mode builds the whole archive
@@ -1754,7 +1754,7 @@ function bundleAdapterStorage(opts) {
     // per-bundle rewrap.
     async rewrapAllBundles(opts) {
       opts = opts || {};
-      var concurrency = 4;                                                            // allow:raw-byte-literal — default fan-out, not byte count
+      var concurrency = 4;                                                            // default fan-out, not byte count
       if (typeof opts.concurrency === "number" && Number.isFinite(opts.concurrency) &&
           opts.concurrency > 0) {
         concurrency = Math.max(1, Math.floor(opts.concurrency));
@@ -1855,7 +1855,7 @@ function bundleAdapterStorage(opts) {
       // a silent ok=0/failed=0 report on non-empty storage. Default
       // 4; minimum 1; non-finite / non-positive falls back to
       // default.
-      var concurrency = 4;                                                            // allow:raw-byte-literal — default fan-out, not byte count
+      var concurrency = 4;                                                            // default fan-out, not byte count
       if (typeof vOpts.concurrency === "number" && Number.isFinite(vOpts.concurrency) &&
           vOpts.concurrency > 0) {
         concurrency = Math.max(1, Math.floor(vOpts.concurrency));
@@ -2096,7 +2096,7 @@ function bundleAdapterStorage(opts) {
         // capped 16-byte readFile via the fallback path (still
         // bounded; better than full payload).
         if (typeof adapter.readPartial === "function") {
-          var probe = await adapter.readPartial(payloadKey, 16);                      // allow:raw-byte-literal — 16-byte probe head, magic comparison
+          var probe = await adapter.readPartial(payloadKey, 16);                      // 16-byte probe head, magic comparison
           envelopeKind = archiveLazy().sniffEnvelope(probe);
         } else {
           // Legacy adapter — readPartial missing. Operators using
@@ -2389,7 +2389,7 @@ bundleAdapterStorage.objectStoreAdapter = function (client, osOpts) {
       // is consumed. PAGINATION_CAP guards against a runaway
       // server returning truncated:true forever (defense-in-depth;
       // shipped backends honour the contract).
-      var PAGINATION_CAP = 1000;                                                      // allow:raw-byte-literal — page count cap, not byte count
+      var PAGINATION_CAP = 1000;                                                      // page count cap, not byte count
       var out = [];
       var token = null;
       var pages = 0;

package/lib/base32.js

@@ -42,7 +42,7 @@ Object.keys(ALPHABETS).forEach(function (v) {
   LOOKUPS[v] = map;
 });
 
-var GROUP = 8;                                              // allow:raw-byte-literal — Base32 emits 8 chars per 5 input bytes (RFC 4648 §6)
+var GROUP = 8;                                              // Base32 emits 8 chars per 5 input bytes (RFC 4648 §6)
 var BITS = 5;                                               // 5 bits per Base32 symbol
 
 function _alphabet(variant) {
@@ -82,14 +82,14 @@ function encode(input, opts) {
   var out = "";
   var value = 0, bits = 0;
   for (var i = 0; i < buf.length; i++) {
-    value = (value << 8) | buf[i];                          // allow:raw-byte-literal — shift in one input byte
-    bits += 8;                                              // allow:raw-byte-literal — eight bits per input byte
+    value = (value << 8) | buf[i];                          // shift in one input byte
+    bits += 8;                                              // eight bits per input byte
     while (bits >= BITS) {
-      out += alphabet.charAt((value >>> (bits - BITS)) & 31);   // allow:raw-byte-literal — low 5 bits mask (2^5 - 1)
+      out += alphabet.charAt((value >>> (bits - BITS)) & 31);   // low 5 bits mask (2^5 - 1)
       bits -= BITS;
     }
   }
-  if (bits > 0) out += alphabet.charAt((value << (BITS - bits)) & 31);   // allow:raw-byte-literal — final partial group, low 5 bits
+  if (bits > 0) out += alphabet.charAt((value << (BITS - bits)) & 31);   // final partial group, low 5 bits
   if (pad) while (out.length % GROUP !== 0) out += "=";
   return out;
 }
@@ -138,9 +138,9 @@ function decode(str, opts) {
     if (idx === undefined) throw new Base32Error("base32/bad-char", "base32.decode: invalid Base32 character '" + str.charAt(i) + "' at index " + i);
     value = (value << BITS) | idx;
     bits += BITS;
-    if (bits >= 8) {                                        // allow:raw-byte-literal — emit a full output byte
-      bytes.push((value >>> (bits - 8)) & 0xff);            // allow:raw-byte-literal — eight-bit output byte mask
-      bits -= 8;                                            // allow:raw-byte-literal — consumed eight bits
+    if (bits >= 8) {                                        // emit a full output byte
+      bytes.push((value >>> (bits - 8)) & 0xff);            // eight-bit output byte mask
+      bits -= 8;                                            // consumed eight bits
     }
   }
   return Buffer.from(bytes);

package/lib/budr.js

@@ -30,8 +30,8 @@ var audit = require("./audit");
 var { defineClass } = require("./framework-error");
 var BudrError = defineClass("BudrError", { alwaysPermanent: true });
 
-var SERVICE_MAX = 128;                                                                        // allow:raw-byte-literal — string-length cap, not bytes
-var SERVICE_RE = /^[a-zA-Z0-9._:/-]{1,128}$/;                                                 // allow:raw-byte-literal — string-length cap; not bytes
+var SERVICE_MAX = 128;                                                                        // string-length cap, not bytes
+var SERVICE_RE = /^[a-zA-Z0-9._:/-]{1,128}$/;                                                 // string-length cap; not bytes
 var TIERS = ["platinum", "gold", "silver", "bronze"];
 var CRITICALITIES = ["critical", "high", "medium", "low"];
 

package/lib/cache-status.js

@@ -47,7 +47,7 @@ var CacheStatusError = defineClass("CacheStatusError", { alwaysPermanent: true }
 // per RFC 8941: starts with ALPHA or "*", continues with tchar / ":"
 // / "/". tchar excludes `, ; " \ space and all controls.
 var CACHE_NAME_RE   = /^[A-Za-z*][!#$%&'*+\-.^_`|~0-9A-Za-z:/]*$/;                                 // allow:duplicate-regex — sf-token shape per RFC 8941 §3.3.4
-var CACHE_NAME_MAX  = 128;                                                                         // allow:raw-byte-literal — cache-name length cap, not bytes
+var CACHE_NAME_MAX  = 128;                                                                         // cache-name length cap, not bytes
 var FWD_VALUES = Object.freeze(["bypass", "method", "uri-miss", "vary-miss", "miss", "request", "stale", "partial"]);
 var BOOLEAN_PARAMS = Object.freeze(["hit", "stored", "collapsed"]);
 // Reserved parameter names per RFC 9211 §2 — the framework knows their
@@ -153,7 +153,7 @@ function entryString(entry) {
   }
   if (entry.fwdStatus !== undefined && entry.fwdStatus !== null) {
     if (typeof entry.fwdStatus !== "number" || !Number.isInteger(entry.fwdStatus) ||
-        entry.fwdStatus < 100 || entry.fwdStatus > 599) {                                          // allow:raw-byte-literal — HTTP status range
+        entry.fwdStatus < 100 || entry.fwdStatus > 599) {                                          // HTTP status range
       throw new CacheStatusError("cache-status/bad-fwd-status",
         "entry.fwdStatus must be an integer 100..599");
     }

package/lib/calendar.js

@@ -98,7 +98,7 @@ var JSCAL_NOTE_STATUS = Object.freeze({
 
 // Recurrence-expansion caps. Mirror b.safeIcal's RRULE limits so the
 // expand path can't outpace what the parser already permitted.
-var MAX_EXPAND_INSTANCES = 4096;                                                                       // allow:raw-byte-literal — instance count cap, not bytes
+var MAX_EXPAND_INSTANCES = 4096;                                                                       // instance count cap, not bytes
 var MAX_EXPAND_SPAN_MS   = 10 * 365 * 24 * 60 * 60 * 1000;                                             // allow:raw-byte-literal + allow:raw-time-literal — 10 year max expansion span
 
 /**
@@ -138,7 +138,7 @@ function validate(jsCal) {
     throw new CalendarError("calendar/no-uid",
       "b.calendar.validate: uid is required (RFC 8984 §5.1.4)");
   }
-  if (jsCal.uid.length > 1024) {                                                                       // allow:raw-byte-literal — anti-DoS uid length cap
+  if (jsCal.uid.length > 1024) {                                                                       // anti-DoS uid length cap
     throw new CalendarError("calendar/oversize-uid",
       "b.calendar.validate: uid exceeds 1024 bytes");
   }
@@ -183,7 +183,7 @@ function validate(jsCal) {
       // refuse.
       if (typeof jsCal.percentComplete !== "number" || !isFinite(jsCal.percentComplete) ||
           !Number.isInteger(jsCal.percentComplete) ||
-          jsCal.percentComplete < 0 || jsCal.percentComplete > 100) {                                  // allow:raw-byte-literal — RFC 8984 §6 percent range
+          jsCal.percentComplete < 0 || jsCal.percentComplete > 100) {                                  // RFC 8984 §6 percent range
         throw new CalendarError("calendar/bad-percent",
           "b.calendar.validate: Task.percentComplete MUST be an integer in 0..100 (RFC 8984 §6.4.4 UnsignedInt)");
       }
@@ -586,7 +586,7 @@ function expandRecurrence(event, opts) {
   // specified, they are expanded independently and the resulting
   // instances are UNIONed (deduped + sorted ascending). Per-rule
   // count caps apply per-rule per the same section.
-  var globalStepBudget = MAX_EXPAND_INSTANCES * 366;                                                   // allow:raw-byte-literal — total days/year step budget shared across all rules
+  var globalStepBudget = MAX_EXPAND_INSTANCES * 366;                                                   // total days/year step budget shared across all rules
   var seen = Object.create(null);
   var unioned = [];
   for (var rrIndex = 0; rrIndex < event.recurrenceRules.length; rrIndex += 1) {
@@ -644,7 +644,7 @@ function _expandSingleRule(rule, startMs, ctx) {
     byMonthSet = Object.create(null);
     for (var mi = 0; mi < rule.byMonth.length; mi += 1) {
       var mn = parseInt(rule.byMonth[mi], 10);
-      if (isFinite(mn) && mn >= 1 && mn <= 12) byMonthSet[mn] = true;                                  // allow:raw-byte-literal — 12 calendar months
+      if (isFinite(mn) && mn >= 1 && mn <= 12) byMonthSet[mn] = true;                                  // 12 calendar months
     }
   }
   var byMonthDaySet = null;
@@ -652,7 +652,7 @@ function _expandSingleRule(rule, startMs, ctx) {
     byMonthDaySet = Object.create(null);
     for (var mdi = 0; mdi < rule.byMonthDay.length; mdi += 1) {
       var mdn = parseInt(rule.byMonthDay[mdi], 10);
-      if (isFinite(mdn) && mdn !== 0 && mdn >= -31 && mdn <= 31) byMonthDaySet[mdn] = true;            // allow:raw-byte-literal — calendar day-of-month bounds
+      if (isFinite(mdn) && mdn !== 0 && mdn >= -31 && mdn <= 31) byMonthDaySet[mdn] = true;            // calendar day-of-month bounds
     }
   }
   // RFC 5545 §3.3.10 — BYWEEKNO refines yearly recurrences to specific
@@ -663,7 +663,7 @@ function _expandSingleRule(rule, startMs, ctx) {
     byWeekNoSet = Object.create(null);
     for (var wni = 0; wni < rule.byWeekNo.length; wni += 1) {
       var wn = parseInt(rule.byWeekNo[wni], 10);
-      if (isFinite(wn) && wn !== 0 && wn >= -53 && wn <= 53) byWeekNoSet[wn] = true;                   // allow:raw-byte-literal — ISO 8601 week-number bounds
+      if (isFinite(wn) && wn !== 0 && wn >= -53 && wn <= 53) byWeekNoSet[wn] = true;                   // ISO 8601 week-number bounds
     }
   }
   // BYYEARDAY — day-of-year (1..366 or -1..-366; negative counts from
@@ -673,7 +673,7 @@ function _expandSingleRule(rule, startMs, ctx) {
     byYearDaySet = Object.create(null);
     for (var ydi = 0; ydi < rule.byYearDay.length; ydi += 1) {
       var yd = parseInt(rule.byYearDay[ydi], 10);
-      if (isFinite(yd) && yd !== 0 && yd >= -366 && yd <= 366) byYearDaySet[yd] = true;                // allow:raw-byte-literal — day-of-year bounds
+      if (isFinite(yd) && yd !== 0 && yd >= -366 && yd <= 366) byYearDaySet[yd] = true;                // day-of-year bounds
     }
   }
   // BYHOUR / BYMINUTE / BYSECOND — time-of-day filters. RFC 5545 §3.3.10
@@ -695,8 +695,8 @@ function _expandSingleRule(rule, startMs, ctx) {
     // unfiltered candidate per RFC 5545's tolerant grammar.
     return hasAny ? s : null;
   }
-  var byHourSet   = _bySet(rule.byHour,   0, 23);                                                      // allow:raw-byte-literal — RFC 5545 hour range
-  var byMinuteSet = _bySet(rule.byMinute, 0, 59);                                                      // allow:raw-byte-literal — RFC 5545 minute range
+  var byHourSet   = _bySet(rule.byHour,   0, 23);                                                      // RFC 5545 hour range
+  var byMinuteSet = _bySet(rule.byMinute, 0, 59);                                                      // RFC 5545 minute range
   var bySecondSet = _bySet(rule.bySecond, 0, 60);                                                      // allow:raw-byte-literal — RFC 5545 second range incl. leap second // allow:raw-time-literal — second-of-minute bound, not a duration
 
   function _isoWeekParts(d) {
@@ -706,7 +706,7 @@ function _expandSingleRule(rule, startMs, ctx) {
     // Returns { week, year }.
     var tmp = new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate()));
     var dayOfWeek = tmp.getUTCDay() || 7;
-    tmp.setUTCDate(tmp.getUTCDate() + 4 - dayOfWeek);                                                  // allow:raw-byte-literal — ISO week-year anchor (Thursday)
+    tmp.setUTCDate(tmp.getUTCDate() + 4 - dayOfWeek);                                                  // ISO week-year anchor (Thursday)
     var weekYear = tmp.getUTCFullYear();
     var yearStart = new Date(Date.UTC(weekYear, 0, 1));
     var week = Math.ceil((((tmp - yearStart) / 86400000) + 1) / 7);                                    // allow:raw-time-literal — 86400000 ms/day, 7 days/week // allow:raw-byte-literal
@@ -720,7 +720,7 @@ function _expandSingleRule(rule, startMs, ctx) {
     return Math.floor((d - startOfYear) / 86400000) + 1;                                               // allow:raw-time-literal — 86400000 ms/day // allow:raw-byte-literal
   }
   function _daysInYear(year) {
-    return ((year % 4 === 0 && year % 100 !== 0) || year % 400 === 0) ? 366 : 365;                      // allow:raw-byte-literal — Gregorian leap-year rule
+    return ((year % 4 === 0 && year % 100 !== 0) || year % 400 === 0) ? 366 : 365;                      // Gregorian leap-year rule
   }
   function _matchesBy(t) {
     var d = new Date(t);
@@ -738,7 +738,7 @@ function _expandSingleRule(rule, startMs, ctx) {
       // a future explicit knob if demand surfaces.
       var iso = _isoWeekParts(d);
       if (iso.year !== d.getUTCFullYear()) return false;
-      var lastWeek = _isoWeekOf(new Date(Date.UTC(d.getUTCFullYear(), 11, 28)));                       // allow:raw-byte-literal — Dec 28 always in last ISO week
+      var lastWeek = _isoWeekOf(new Date(Date.UTC(d.getUTCFullYear(), 11, 28)));                       // Dec 28 always in last ISO week
       if (!byWeekNoSet[iso.week] && !byWeekNoSet[-(lastWeek - iso.week + 1)]) return false;
     }
     if (byYearDaySet) {
@@ -814,7 +814,7 @@ function _bySetPosArray(raw) {
   var out = [];
   for (var i = 0; i < raw.length; i += 1) {
     var n = parseInt(raw[i], 10);
-    if (isFinite(n) && n !== 0 && n >= -366 && n <= 366) out.push(n);                                  // allow:raw-byte-literal — RFC 5545 §3.3.10 bysetpos range
+    if (isFinite(n) && n !== 0 && n >= -366 && n <= 366) out.push(n);                                  // RFC 5545 §3.3.10 bysetpos range
   }
   return out.length > 0 ? out : null;
 }
@@ -864,7 +864,7 @@ function _expandWithBysetpos(ctx) {
     // periods (e.g. YEARLY = 366 days) can't loop forever.
     var candidates = [];
     var dayMs = period.startMs;
-    var safety = 400;                                                                                  // allow:raw-byte-literal — period day cap (covers leap year 366 + slack)
+    var safety = 400;                                                                                  // period day cap (covers leap year 366 + slack)
     while (dayMs <= period.endMs && safety-- > 0 && stepBudgetRef.remaining > 0) {
       stepBudgetRef.remaining -= 1;
       var candidate = _withTimeOfDay(dayMs, hh, mm, ss, ms);
@@ -919,8 +919,8 @@ function _periodForIndex(freq, startDate, offset) {
   }
   if (freq === "monthly") {
     var bm = startDate.getUTCMonth() + offset;
-    var by = startDate.getUTCFullYear() + Math.floor(bm / 12);                                         // allow:raw-byte-literal — months/year
-    var mm = ((bm % 12) + 12) % 12;                                                                    // allow:raw-byte-literal — months/year
+    var by = startDate.getUTCFullYear() + Math.floor(bm / 12);                                         // months/year
+    var mm = ((bm % 12) + 12) % 12;                                                                    // months/year
     var ms = Date.UTC(by, mm, 1, 0, 0, 0, 0);
     var me = Date.UTC(by, mm + 1, 1, 0, 0, 0, 0) - 1;
     return { startMs: ms, endMs: me };
@@ -928,7 +928,7 @@ function _periodForIndex(freq, startDate, offset) {
   // weekly — align to WKST=Monday (RFC 5545 default WKST).
   var anchor = new Date(Date.UTC(startDate.getUTCFullYear(), startDate.getUTCMonth(), startDate.getUTCDate(), 0, 0, 0, 0));
   var dow = anchor.getUTCDay() || 7;
-  anchor.setUTCDate(anchor.getUTCDate() - (dow - 1) + offset * 7);                                     // allow:raw-byte-literal — days/week
+  anchor.setUTCDate(anchor.getUTCDate() - (dow - 1) + offset * 7);                                     // days/week
   var ws = anchor.getTime();
   var we = ws + 7 * 86400000 - 1;                                                                      // allow:raw-byte-literal + allow:raw-time-literal — 7-day window
   return { startMs: ws, endMs: we };
@@ -1021,7 +1021,7 @@ function _vtodoToJsCalTask(vt) {
   var percent = _firstValue(props["PERCENT-COMPLETE"]);
   if (percent !== null && percent !== undefined) {
     var pn = parseInt(percent, 10);
-    if (isFinite(pn) && pn >= 0 && pn <= 100) jsCal.percentComplete = pn;                              // allow:raw-byte-literal — RFC 8984 §6 percent range
+    if (isFinite(pn) && pn >= 0 && pn <= 100) jsCal.percentComplete = pn;                              // RFC 8984 §6 percent range
   }
   var completed = _firstValue(props.COMPLETED);
   if (completed) jsCal.progressUpdated = _icalDateTimeToUtc(completed);
@@ -1202,7 +1202,7 @@ function _advance(ms, freq, interval) {
   var d = new Date(ms);
   switch (freq) {
   case "daily":   d.setUTCDate(d.getUTCDate() + interval); break;
-  case "weekly":  d.setUTCDate(d.getUTCDate() + 7 * interval); break;                                  // allow:raw-byte-literal — 7 days/week
+  case "weekly":  d.setUTCDate(d.getUTCDate() + 7 * interval); break;                                  // 7 days/week
   case "monthly": d.setUTCMonth(d.getUTCMonth() + interval); break;
   case "yearly":  d.setUTCFullYear(d.getUTCFullYear() + interval); break;
   case "hourly":  d.setUTCHours(d.getUTCHours() + interval); break;
@@ -1227,10 +1227,10 @@ function _foldLine(s) {
   // RFC 5545 §3.1 — content lines SHOULD NOT exceed 75 octets; fold
   // with CRLF + leading space. We let the joining code add the
   // trailing CRLF; this helper only inserts the intra-line fold.
-  if (s.length <= 75) return s;                                                                        // allow:raw-byte-literal — RFC 5545 §3.1 line-length cap
+  if (s.length <= 75) return s;                                                                        // RFC 5545 §3.1 line-length cap
   var out = "";
-  for (var i = 0; i < s.length; i += 73) {                                                             // allow:raw-byte-literal — 73 = 75 minus the CR/LF wrap
-    out += (i === 0 ? "" : "\r\n ") + s.slice(i, i + 73);                                              // allow:raw-byte-literal — same cap
+  for (var i = 0; i < s.length; i += 73) {                                                             // 73 = 75 minus the CR/LF wrap
+    out += (i === 0 ? "" : "\r\n ") + s.slice(i, i + 73);                                              // same cap
   }
   return out;
 }

package/lib/cbor.js

@@ -58,15 +58,15 @@ var { defineClass } = require("./framework-error");
 
 var CborError = defineClass("CborError", { alwaysPermanent: true });
 
-var DEFAULT_MAX_DEPTH = 64;                                                            // allow:raw-byte-literal — nesting depth, not a size
-var ABSOLUTE_MAX_DEPTH = 256;                                                          // allow:raw-byte-literal — nesting depth ceiling, not a size
+var DEFAULT_MAX_DEPTH = 64;                                                            // nesting depth, not a size
+var ABSOLUTE_MAX_DEPTH = 256;                                                          // nesting depth ceiling, not a size
 var DEFAULT_MAX_BYTES = C.BYTES.mib(16);
 var ABSOLUTE_MAX_BYTES = C.BYTES.mib(64);
 
 // CBOR / IEEE-754 wire constants (not byte sizes — protocol values).
-var CBOR_AI_1BYTE = 24;            // allow:raw-byte-literal — RFC 8949 §3 additional-info boundary (inline vs 1-byte argument)
-var BYTES_64BIT = 8;               // allow:raw-byte-literal — width of a CBOR uint64 / float64 argument, not a cap
-var FLOAT16_MANT_DIV = 1024;       // allow:raw-byte-literal — IEEE 754 half-precision mantissa scale (2^10), not a size
+var CBOR_AI_1BYTE = 24;            // RFC 8949 §3 additional-info boundary (inline vs 1-byte argument)
+var BYTES_64BIT = 8;               // width of a CBOR uint64 / float64 argument, not a cap
+var FLOAT16_MANT_DIV = 1024;       // IEEE 754 half-precision mantissa scale (2^10), not a size
 
 /**
  * @primitive b.cbor.Tag
@@ -110,9 +110,9 @@ function _capInt(v, dflt, absolute) {
 // + SCITT depend on this — emitting float64 for a value representable
 // in float16 is non-canonical and trips requireDeterministic.
 function _encodeFloat(value) {
-  if (Number.isNaN(value)) return Buffer.from([0xf9, 0x7e, 0x00]);                      // allow:raw-byte-literal — canonical half NaN (RFC 8949 §4.2.1)
-  if (value === Infinity) return Buffer.from([0xf9, 0x7c, 0x00]);                       // allow:raw-byte-literal — half +Inf
-  if (value === -Infinity) return Buffer.from([0xf9, 0xfc, 0x00]);                      // allow:raw-byte-literal — half -Inf
+  if (Number.isNaN(value)) return Buffer.from([0xf9, 0x7e, 0x00]);                      // canonical half NaN (RFC 8949 §4.2.1)
+  if (value === Infinity) return Buffer.from([0xf9, 0x7c, 0x00]);                       // half +Inf
+  if (value === -Infinity) return Buffer.from([0xf9, 0xfc, 0x00]);                      // half -Inf
   var half = _doubleToHalfBits(value);
   if (half >= 0) { var hb = Buffer.alloc(3); hb[0] = 0xf9; hb.writeUInt16BE(half, 1); return hb; }
   var f4 = Buffer.alloc(5); f4[0] = 0xfa; f4.writeFloatBE(value, 1);
@@ -167,10 +167,10 @@ function _head(major, argument) {
 }
 
 function _encodeValue(value, opts) {
-  if (value === null) return Buffer.from([0xf6]);                                       // allow:raw-byte-literal — CBOR null simple value
-  if (value === undefined) return Buffer.from([0xf7]);                                  // allow:raw-byte-literal — CBOR undefined simple value
-  if (value === true) return Buffer.from([0xf5]);                                       // allow:raw-byte-literal — CBOR true simple value
-  if (value === false) return Buffer.from([0xf4]);                                      // allow:raw-byte-literal — CBOR false simple value
+  if (value === null) return Buffer.from([0xf6]);                                       // CBOR null simple value
+  if (value === undefined) return Buffer.from([0xf7]);                                  // CBOR undefined simple value
+  if (value === true) return Buffer.from([0xf5]);                                       // CBOR true simple value
+  if (value === false) return Buffer.from([0xf4]);                                      // CBOR false simple value
 
   if (typeof value === "number") {
     // Exact integers within the safe range encode as CBOR integers;

package/lib/cdn-cache-control.js

@@ -251,7 +251,7 @@ function build(opts) {
     // regex. RFC 7234 §5.2 token directives are tiny in practice
     // (max-age = 7 chars, stale-while-revalidate = 22); 64 is the
     // operator-headroom ceiling.
-    var DIRECTIVE_MAX = 64;                                                                        // allow:raw-byte-literal — directive key/value length cap
+    var DIRECTIVE_MAX = 64;                                                                        // directive key/value length cap
     for (var e = 0; e < ekeys.length; e += 1) {
       var ek = ekeys[e];
       if (ek.length === 0 || ek.length > DIRECTIVE_MAX || !DIRECTIVE_KEY_RE.test(ek)) {

package/lib/cert.js

@@ -69,8 +69,8 @@ var log = boot("cert");
 var DEFAULT_RENEW_INTERVAL_MS    = C.TIME.hours(6);
 var DEFAULT_MIN_DAYS_BEFORE_EXPIRY = 14;
 var DEFAULT_OCSP_REFRESH_MS      = C.TIME.hours(12);
-var MAX_DOMAINS_PER_CERT         = 100;                                              // allow:raw-byte-literal — operator-facing manifest size cap, not a byte count (RFC 6066 SNI permits more)
-var MAX_CERTS_PER_MANAGER        = 1000;                                             // allow:raw-byte-literal — operator-facing manifest size cap, not a byte count
+var MAX_DOMAINS_PER_CERT         = 100;                                              // operator-facing manifest size cap, not a byte count (RFC 6066 SNI permits more)
+var MAX_CERTS_PER_MANAGER        = 1000;                                             // operator-facing manifest size cap, not a byte count
 
 function _positiveFiniteOrDefault(value, defaultValue, label, code) {
   if (value === undefined || value === null) return defaultValue;
@@ -481,9 +481,9 @@ function create(opts) {
   // counts. The framework's leaf-key alg names embed the bit length
   // verbatim ("rsa-2048" / "rsa-3072" / "rsa-4096"), so the literals
   // here are protocol-constant references.
-  var RSA_MODULUS_BITS_2048 = 2048;                                                  // allow:raw-byte-literal — RSA modulus length, not a byte count
-  var RSA_MODULUS_BITS_3072 = 3072;                                                  // allow:raw-byte-literal — RSA modulus length, not a byte count
-  var RSA_MODULUS_BITS_4096 = 4096;                                                  // allow:raw-byte-literal — RSA modulus length, not a byte count
+  var RSA_MODULUS_BITS_2048 = 2048;                                                  // RSA modulus length, not a byte count
+  var RSA_MODULUS_BITS_3072 = 3072;                                                  // RSA modulus length, not a byte count
+  var RSA_MODULUS_BITS_4096 = 4096;                                                  // RSA modulus length, not a byte count
 
   function _generateLeafKeypair(keyAlg) {
     switch (keyAlg) {

package/lib/cloud-events.js

@@ -275,8 +275,8 @@ function parse(envelope) {
 
 // ---- validate / isValid (non-throwing spec check) ----
 
-var INT_MIN = -2147483648;                                  // allow:raw-byte-literal — CloudEvents Integer type range
-var INT_MAX = 2147483647;                                   // allow:raw-byte-literal — CloudEvents Integer type range
+var INT_MIN = -2147483648;                                  // CloudEvents Integer type range
+var INT_MAX = 2147483647;                                   // CloudEvents Integer type range
 // JSON-formatted media type essence (after the parameters are stripped):
 // type/json or type/anything+json. Each run is bounded by the single "/"
 // separator so the match is linear (no overlapping quantifiers → no
@@ -515,8 +515,8 @@ function _pctEncode(s) {
   var out = "";
   for (var i = 0; i < bytes.length; i += 1) {
     var by = bytes[i];
-    if (by < 0x21 || by > 0x7E || by === 0x22 || by === 0x25) {   // allow:raw-byte-literal — printable-ASCII bounds + double-quote and percent (HTTP binding header rule)
-      out += "%" + bytes[i].toString(16).toUpperCase().padStart(2, "0");   // allow:raw-byte-literal — 16 is the hex radix
+    if (by < 0x21 || by > 0x7E || by === 0x22 || by === 0x25) {   // printable-ASCII bounds + double-quote and percent (HTTP binding header rule)
+      out += "%" + bytes[i].toString(16).toUpperCase().padStart(2, "0");   // 16 is the hex radix
     } else {
       out += String.fromCharCode(by);
     }
@@ -528,7 +528,7 @@ function _pctDecode(s) {
   var i = 0;
   while (i < s.length) {
     if (s[i] === "%" && /^[0-9A-Fa-f]{2}$/.test(s.slice(i + 1, i + 3))) {
-      bytes.push(parseInt(s.slice(i + 1, i + 3), 16));   // allow:raw-byte-literal — 16 is the hex radix
+      bytes.push(parseInt(s.slice(i + 1, i + 3), 16));   // 16 is the hex radix
       i += 3;
     } else {
       var ch = Buffer.from(s[i], "utf8");

package/lib/cms-codec.js

@@ -107,14 +107,14 @@ var OID = Object.freeze({
 });
 
 // Refusal ceilings.
-var MAX_DEPTH       = 32;                                                                             // allow:raw-byte-literal — ASN.1 recursion ceiling
+var MAX_DEPTH       = 32;                                                                             // ASN.1 recursion ceiling
 var DEFAULT_MAX_LEN = 64 * 1024 * 1024;                                                               // allow:raw-byte-literal — 64 MiB default decode cap
 
 // Universal-tag bytes used in encode helpers.
-var TAG_SEQUENCE = 0x30;                                                                              // allow:raw-byte-literal — ASN.1 SEQUENCE constructed
-var TAG_SET      = 0x31;                                                                              // allow:raw-byte-literal — ASN.1 SET constructed
-var TAG_UTCTIME  = 0x17;                                                                              // allow:raw-byte-literal — UTCTime universal
-var TAG_GENTIME  = 0x18;                                                                              // allow:raw-byte-literal — GeneralizedTime universal
+var TAG_SEQUENCE = 0x30;                                                                              // ASN.1 SEQUENCE constructed
+var TAG_SET      = 0x31;                                                                              // ASN.1 SET constructed
+var TAG_UTCTIME  = 0x17;                                                                              // UTCTime universal
+var TAG_GENTIME  = 0x18;                                                                              // GeneralizedTime universal
 
 /**
  * @primitive b.cms.encodeSignedData
@@ -197,7 +197,7 @@ function encodeSignedData(opts) {
 
   // SignedData SEQUENCE per §5.1.
   var signedDataSeq = asn1.writeNode(TAG_SEQUENCE, Buffer.concat([
-    asn1.writeInteger(Buffer.from([1])),                                                              // allow:raw-byte-literal — CMSVersion 1 per §5.1
+    asn1.writeInteger(Buffer.from([1])),                                                              // CMSVersion 1 per §5.1
     digestAlgs,
     encapInfo,
     certsBlock,
@@ -258,7 +258,7 @@ function encodeEnvelopedData(opts) {
       "encodeEnvelopedData: opts.recipients must be a non-empty array");
   }
   // Fresh ChaCha20-Poly1305 content key.
-  var contentKey = bCrypto.generateBytes(32);                                                         // allow:raw-byte-literal — 256-bit ChaCha20 key
+  var contentKey = bCrypto.generateBytes(32);                                                         // 256-bit ChaCha20 key
 
   // recipientInfos SET — one KEMRecipientInfo per recipient.
   var ris = opts.recipients.map(function (r) {
@@ -272,7 +272,7 @@ function encodeEnvelopedData(opts) {
   // EnvelopedData SEQUENCE per §6.1. CMSVersion 4 (RFC 9629 §3 — when
   // any RecipientInfo is OtherRecipientInfo, here KEMRecipientInfo).
   var envelopedSeq = asn1.writeNode(TAG_SEQUENCE, Buffer.concat([
-    asn1.writeInteger(Buffer.from([4])),                                                              // allow:raw-byte-literal — CMSVersion 4 per RFC 9629 §3
+    asn1.writeInteger(Buffer.from([4])),                                                              // CMSVersion 4 per RFC 9629 §3
     recipientInfosSet,
     encContent,
   ]));
@@ -334,7 +334,7 @@ function decode(buf, opts) {
   }
   if (!(node.tag === asn1.TAG.SEQUENCE && node.constructed)) {
     throw new CmsCodecError("cms/bad-content-info",
-      "decode: top-level must be SEQUENCE (got tag 0x" + node.tag.toString(16) + ")");                // allow:raw-byte-literal — hex radix for error-message formatting
+      "decode: top-level must be SEQUENCE (got tag 0x" + node.tag.toString(16) + ")");                // hex radix for error-message formatting
   }
   // ContentInfo SEQUENCE children: { contentType OID, [0] EXPLICIT ANY }.
   var children;
@@ -399,7 +399,7 @@ function _writeImplicitConstructed(tagNumber, payload) {
   // [N] IMPLICIT context-specific CONSTRUCTED — for wrapping SEQUENCE /
   // SET payloads (e.g. certificates [0], crls [1], OtherRecipientInfo
   // value).
-  var tagByte = 0xa0 | (tagNumber & 0x1f);                                                            // allow:raw-byte-literal — context-specific constructed mask
+  var tagByte = 0xa0 | (tagNumber & 0x1f);                                                            // context-specific constructed mask
   return asn1.writeNode(tagByte, payload);
 }
 
@@ -410,7 +410,7 @@ function _writeImplicitPrimitive(tagNumber, value) {
   // reject the structure (Codex P1 finding on PR #102 — RecipientIdentifier
   // CHOICE's SubjectKeyIdentifier alternative is `[0] IMPLICIT OCTET STRING`,
   // a primitive type).
-  var tagByte = 0x80 | (tagNumber & 0x1f);                                                            // allow:raw-byte-literal — context-specific primitive mask
+  var tagByte = 0x80 | (tagNumber & 0x1f);                                                            // context-specific primitive mask
   return asn1.writeNode(tagByte, value);
 }
 
@@ -459,7 +459,7 @@ function _signerInfo(signer, msgDigest, digestOid) {
   // SignerInfo, and use the original `31 LL VV...` form as the signature
   // input.
   var signatureInput = signedAttrs;
-  var signedAttrsImplicit = Buffer.concat([Buffer.from([0xa0]),                                       // allow:raw-byte-literal — IMPLICIT [0] tag per RFC 5652 §5.3
+  var signedAttrsImplicit = Buffer.concat([Buffer.from([0xa0]),                                       // IMPLICIT [0] tag per RFC 5652 §5.3
                                             signedAttrs.slice(1)]);
 
   var signature;
@@ -474,7 +474,7 @@ function _signerInfo(signer, msgDigest, digestOid) {
 
   // SignerInfo SEQUENCE per §5.3 (issuerAndSerialNumber variant — CMSVersion 1).
   return asn1.writeNode(TAG_SEQUENCE, Buffer.concat([
-    asn1.writeInteger(Buffer.from([1])),                                                              // allow:raw-byte-literal — CMSVersion 1 for issuerAndSerialNumber
+    asn1.writeInteger(Buffer.from([1])),                                                              // CMSVersion 1 for issuerAndSerialNumber
     _issuerAndSerialNumber(signer.certificate),
     _algorithmIdentifier(digestOid),
     signedAttrsImplicit,
@@ -576,9 +576,9 @@ function _reEncodeNode(node) {
   // TLV. writeNode rebuilds canonical DER from the original tag byte +
   // value bytes; the tag byte is reconstructed from tagClass + constructed +
   // tag number.
-  var classBits  = (node.tagClass & 0x03) << 6;                                                       // allow:raw-byte-literal — tag-class shift
-  var consBit    = node.constructed ? 0x20 : 0x00;                                                    // allow:raw-byte-literal — constructed bit
-  var tagBits    = node.tag & 0x1f;                                                                   // allow:raw-byte-literal — short-form tag
+  var classBits  = (node.tagClass & 0x03) << 6;                                                       // tag-class shift
+  var consBit    = node.constructed ? 0x20 : 0x00;                                                    // constructed bit
+  var tagBits    = node.tag & 0x1f;                                                                   // short-form tag
   var tagByte    = classBits | consBit | tagBits;
   return asn1.writeNode(tagByte, node.value);
 }
@@ -620,7 +620,7 @@ function _recipientInfo(recipient, contentKey) {
   // composition path.
   var infoLabel = Buffer.from("cms/kemri/chacha20-poly1305", "ascii");
   var kdfInput  = Buffer.concat([Buffer.from(encap.sharedSecret), infoLabel]);
-  var kek       = bCrypto.kdf(kdfInput, 32);                                                          // allow:raw-byte-literal — 256-bit KEK
+  var kek       = bCrypto.kdf(kdfInput, 32);                                                          // 256-bit KEK
   // Wrap the content key under the KEK using ChaCha20-Poly1305.
   var wrapped;
   try { wrapped = bCrypto.encryptPacked(contentKey, kek); }
@@ -631,7 +631,7 @@ function _recipientInfo(recipient, contentKey) {
   // KEMRecipientInfo SEQUENCE.
   // Simplified ordering, version 0 per RFC 9629 §3.
   var kemRi = asn1.writeNode(TAG_SEQUENCE, Buffer.concat([
-    asn1.writeInteger(Buffer.from([0])),                                                              // allow:raw-byte-literal — KEMRecipientInfo version 0
+    asn1.writeInteger(Buffer.from([0])),                                                              // KEMRecipientInfo version 0
     // rid CHOICE per RFC 9629 §3: this module ships the [0] IMPLICIT
     // SubjectKeyIdentifier alternative — SKI is `[0] IMPLICIT OCTET
     // STRING` (PRIMITIVE per RFC 5652 §10.2.4). The constructed form
@@ -642,7 +642,7 @@ function _recipientInfo(recipient, contentKey) {
     _algorithmIdentifier(OID.mlkem1024),                                                              // kem
     asn1.writeOctetString(Buffer.from(encap.cipherText)),                                             // kemct
     _algorithmIdentifier(OID.shake256),                                                               // kdf
-    asn1.writeInteger(Buffer.from([32])),                                                             // allow:raw-byte-literal — kekLength = 32 bytes
+    asn1.writeInteger(Buffer.from([32])),                                                             // kekLength = 32 bytes
     _algorithmIdentifier(OID.chacha20Poly1305),                                                       // wrap (also used as content-encryption AlgId; same OID)
     asn1.writeOctetString(wrapped),                                                                   // encryptedKey
   ]));
@@ -653,7 +653,7 @@ function _recipientInfo(recipient, contentKey) {
     asn1.writeOid(OID.kemri),
     kemRi,
   ]);
-  return asn1.writeNode(0xa4, oriValue);                                                              // allow:raw-byte-literal — [4] IMPLICIT context-specific constructed (ori CHOICE)
+  return asn1.writeNode(0xa4, oriValue);                                                              // [4] IMPLICIT context-specific constructed (ori CHOICE)
 }
 
 function _encryptedContentInfo(plaintext, contentKey) {
@@ -797,7 +797,7 @@ function _readSignerInfo(siNode) {
   var signedAttrsRaw = null;
   if (c[idx] && c[idx].tagClass === asn1.TAG_CLASS.CONTEXT_SPECIFIC && c[idx].tag === 0) {
     var implicitRaw = _reEncodeNode(c[idx]);
-    signedAttrsRaw = Buffer.concat([Buffer.from([0x31]), implicitRaw.slice(1)]);                      // allow:raw-byte-literal — universal SET tag per RFC 5652 §5.4
+    signedAttrsRaw = Buffer.concat([Buffer.from([0x31]), implicitRaw.slice(1)]);                      // universal SET tag per RFC 5652 §5.4
     idx += 1;
   }
   var sigAlgOid = _readAlgIdOid(c[idx]); idx += 1;

package/lib/codepoint-class.js

@@ -50,7 +50,7 @@
  *     WJ   U+2060  BOM  U+FEFF
  */
 
-var HEX_RADIX = 16;                                                 // allow:raw-byte-literal — base-16 radix, not byte size
+var HEX_RADIX = 16;                                                 // base-16 radix, not byte size
 
 function hex4(cp) {
   var s = cp.toString(HEX_RADIX).toUpperCase();
@@ -94,17 +94,17 @@ var BOM_CHAR  = fromCp(0xFEFF);
 // is a single edit.
 var SCRIPT_RANGES = {
   latin:    [[0x0041, 0x005A], [0x0061, 0x007A],
-             [0x00C0, 0x024F], [0x1E00, 0x1EFF]],                                 // allow:raw-byte-literal — Unicode script ranges
-  cyrillic: [[0x0400, 0x04FF], [0x0500, 0x052F]],                                 // allow:raw-byte-literal — Unicode Cyrillic + Cyrillic Supplement
-  greek:    [[0x0370, 0x03FF], [0x1F00, 0x1FFF]],                                 // allow:raw-byte-literal — Unicode Greek + Greek Extended
-  armenian: [[0x0530, 0x058F]],                                                   // allow:raw-byte-literal — Unicode Armenian
-  cherokee: [[0x13A0, 0x13FF], [0xAB70, 0xABBF]],                                 // allow:raw-byte-literal — Unicode Cherokee + Cherokee Supplement
-  han:      [[0x4E00, 0x9FFF]],                                                   // allow:raw-byte-literal — CJK Unified Ideographs
-  hiragana: [[0x3040, 0x309F]],                                                   // allow:raw-byte-literal — Hiragana
-  katakana: [[0x30A0, 0x30FF]],                                                   // allow:raw-byte-literal — Katakana
-  hangul:   [[0xAC00, 0xD7AF]],                                                   // allow:raw-byte-literal — Hangul Syllables
-  arabic:   [[0x0600, 0x06FF]],                                                   // allow:raw-byte-literal — Arabic
-  hebrew:   [[0x0590, 0x05FF]],                                                   // allow:raw-byte-literal — Hebrew
+             [0x00C0, 0x024F], [0x1E00, 0x1EFF]],                                 // Unicode script ranges
+  cyrillic: [[0x0400, 0x04FF], [0x0500, 0x052F]],                                 // Unicode Cyrillic + Cyrillic Supplement
+  greek:    [[0x0370, 0x03FF], [0x1F00, 0x1FFF]],                                 // Unicode Greek + Greek Extended
+  armenian: [[0x0530, 0x058F]],                                                   // Unicode Armenian
+  cherokee: [[0x13A0, 0x13FF], [0xAB70, 0xABBF]],                                 // Unicode Cherokee + Cherokee Supplement
+  han:      [[0x4E00, 0x9FFF]],                                                   // CJK Unified Ideographs
+  hiragana: [[0x3040, 0x309F]],                                                   // Hiragana
+  katakana: [[0x30A0, 0x30FF]],                                                   // Katakana
+  hangul:   [[0xAC00, 0xD7AF]],                                                   // Hangul Syllables
+  arabic:   [[0x0600, 0x06FF]],                                                   // Arabic
+  hebrew:   [[0x0590, 0x05FF]],                                                   // Hebrew
 };
 
 // scriptFor(cp) — returns the script-name string for a codepoint, or